The Gold Standard · Experimental Design
Make the decision path visible
A governance deadlock can end on paper while the old interim state continues in systems. The final authority may reject current exports, yet a scheduler still runs monthly, a repository role still permits execution and downstream teams still read the temporary approval note. The organisation then has two practical answers to the same decision.
The gold standard treats propagation as part of the decision itself. It identifies every authority-bearing consumer, blocks stale permissions, verifies effect rather than delivery and reconciles work performed between the final decision and operational convergence.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · MAP AUTHORITY
1. Define propagation failure
Propagation fails when an authoritative final decision exists but one or more systems, people or workflows continue to enforce an earlier interim state. The record can be correct while practical authority is wrong.
Distinguish notification failure from enforcement failure. A recipient may read the decision yet leave the scheduler or role unchanged.
CHAPTER 2 OF 12 · MAP AUTHORITY
2. Identify authority-bearing consumers
Map access groups, execution services, schedulers, repositories, export gates, notebooks, model registries and downstream approval records. Mark which can run, publish or rely on the analytical set.
Read-only historical access is different from permission to execute or influence a current decision.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · MAP AUTHORITY
3. Translate the final decision into required state
Express each decision term as an observable system change: role removed, job disabled, export blocked, purpose narrowed, expiry set and downstream record superseded. Assign an owner and deadline.
Narrative decisions are easier to misapply when they are not translated into verifiable controls.
| Consumer | Required state |
|---|---|
| Repository role | Purpose-limited |
| Scheduler | Disabled or approved |
| Export gate | Final rule enforced |
| Downstream record | Version updated |
CHAPTER 4 OF 12 · CONTAIN STALE ACCESS
4. Freeze stale interim permissions
Immediately suspend permissions whose compatibility with the final decision is unknown. Preserve logs, manifests and evidence needed for review; do not delete them as a shortcut.
Containment should stop authority leakage while keeping the record needed to understand what happened.
CHAPTER 5 OF 12 · CONTAIN STALE ACCESS
5. Use effect receipts, not sent notices
Require proof from each consumer that the intended state changed: denied test run, disabled schedule, rejected export or updated decision gate. Escalate missing and contradictory receipts.
A delivery confirmation shows that a message arrived. It does not show that authority changed.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · CONTAIN STALE ACCESS
6. Worked example: exports rejected, temporary role persists
Final authority rejects current-data export but permits isolated historical inspection. The decision record is signed, yet the temporary repository role still allows an analyst to run the monthly export job because its removal ticket was routed to the wrong service owner.
The incident owner disables the job, revokes the role, preserves the attempted-run log and traces outputs since the effective time. Changed-context check: if the same role is needed for a separately authorised historical replica, split the permission by environment and purpose rather than restoring broad access.
| Control | Evidence |
|---|---|
| Role removal | Denied test |
| Job disablement | No next run |
| Export block | Gate rejection |
| Supersession | Current version shown |
CHAPTER 7 OF 12 · PROPAGATE AND RECONCILE
7. Reconcile authority from source to enforcement
Choose one source for the final decision version, then compare every consumer’s effective state and local exceptions. Resolve conflicts through the named authority, not by whichever system changed first.
Authority reconciliation should preserve legitimate narrower permissions while removing inherited or ambiguous ones.
CHAPTER 8 OF 12 · PROPAGATE AND RECONCILE
8. Repair activity during the propagation window
Trace runs, exports, publications and decisions between the final effective time and verified convergence. Recompute or withdraw only material downstream uses; preserve evidence and stable findings.
Unauthorised execution is a governance defect, not automatic proof that every result is scientifically false.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · PROPAGATE AND RECONCILE
9. Close with an attributable convergence record
Record the final version, affected consumers, state changes, effect receipts, unresolved exceptions and completed downstream repairs. Give each residual item an owner and expiry.
Closure requires operational convergence or a visible bounded exception, not a green communication dashboard.
| Activity | Response |
|---|---|
| No material use | Preserve log |
| Current export | Withdraw or replace |
| Published finding | Assess difference |
| Evidence-only run | Retain if permitted |
CHAPTER 10 OF 12 · KEEP AUTHORITY ALIGNED
10. Test decision propagation under changed conditions
Simulate staff departure, renamed repository, restored backup, duplicate scheduler, emergency approval and delayed consumer. Confirm stale interim permission cannot reappear.
Include negative tests that attempt the forbidden action; configuration inspection alone may miss an alternate route.
CHAPTER 11 OF 12 · KEEP AUTHORITY ALIGNED
11. State limits and misconceptions
No inventory proves that every local copy or credential is known. Rapid revocation can also interrupt legitimate evidence preservation when purposes are not separated.
Record untested consumers, emergency boundaries and the evidence supporting the remaining access.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · KEEP AUTHORITY ALIGNED
12. Audit decision-to-effect alignment
Track final decisions, required state, implementation delay, stale attempts, failed receipts, exceptions, repaired outputs and recurrence. Compare active permissions with current authority on a regular cadence.
The gold standard makes the final decision real everywhere it matters. A signed record, a technical control and a downstream use all tell the same accountable story.
| Measure | Warning |
|---|---|
| Implementation delay | Authority gap |
| Stale run attempt | Permission persists |
| Missing receipt | Effect unknown |
| Broad exception | Purpose drift |
Frequently asked questions
Is sending the final decision enough?
No. Each authority-bearing consumer should provide evidence that the required permission or gate changed.
Should all access be deleted immediately?
Suspend incompatible execution and export while preserving bounded evidence and historical access that the final decision allows.
Are results from the propagation window automatically invalid?
No. Review whether unauthorised activity materially affected a current use, then repair that use with traceable evidence.
When is authority reconciled?
When the final decision, active permissions, schedulers, export gates and downstream records agree, with any residual exception explicit and time-bounded.
Continue through verified routes
Core routes
Experimental Design subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Approval conflict escalation deadlock, interim authority boundaries and final decision recording
- Second-line approval conflicts, conditional reauthorisation and escalation
- Exception reauthorisation conditions, purpose drift and second-line approval
- Exception register expiry, orphaned owners and reauthorisation evidence